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Period for Reply 

A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) FROM 
THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1.136(a). In no event, however, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 

- If the period for reply specified above is less than thirty (30) days, a reply within the statutory minimum of thirty (30) days will be considered timefy. 

- If NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication. 

- Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 133). 
Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent term adjustment. See 37 CFR 1.704(b). 

Status 

1)S Responsive to communication(s) filed on 26 July 2004 . 
2a)S This action is FINAL. 2b)D This action is non-final. 

3) D Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quayle, 1935 CD. 1 1 , 453 O.G. 213. 

Disposition of Claims 

4) S Claim(s) 1-15 is/are pending in the application. 

4a) Of the above claim(s) is/are withdrawn from consideration. 

5) D Claim(s) is/are allowed. 

6) [3 Claim(s) 1-15 is/are rejected. 

7) D Claim(s) is/are objected to. 

8) D Claim(s) are subject to restriction and/or election requirement. 

Application Papers 

9) D The specification is objected to by the Examiner. 

10) D The drawing(s) filed on is/are: a)D accepted or b)D objected to by the Examiner. 

Applicant may not request that any objection to the drawing(s) be held in abeyance. See 37 CFR 1.85(a). 
Replacement drawing sheet(s) including the correction is required if the drawing(s) is objected to. See 37 CFR 1 .121(d). 

1 1) D The oath or declaration is objected to by the Examiner. Note the attached Office Action or form PTO-152. 

Priority under 35 U.S.C. § 119 

12) D Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 119(a)-(d) or (0- 
a)D All b)D Some * c)D None of: 

1 .□ Certified copies of the priority documents have been received. 

2. D Certified copies of the priority documents have been received in Application No. . 

3. Q Copies of the certified copies of the priority documents have been received in this National Stage 

application from the International Bureau (PCT Rule 17.2(a)). 
* See the attached detailed Office action for a list of the certified copies not received. 
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DETAILED ACTION 
Status of Claims 

1. This action is in response to the amendment received on 26 July 2004. 

2. Claims 1-15 have been examined. 

3. The rejections of claims 1-15 are unchanged. 



RESPONSE TO ARGUMENTS 

4. Applicant's arguments received on 25 March 2004 have been fully considered but they 
are not persuasive. Referring to the previous Office action, Examiner has cited relevant 
portions of the references as a means to illustrate the systems as taught by the prior art. 
As a means of providing further clarification as to what is taught by the references used in 
the first Office action, Examiner has expanded the teachings for comprehensibility while 
maintaining the same grounds of rejection of the claims, except as noted above in the 
section labeled "Status of Claims." This information is intended to assist in illuminating 
the teachings of the references while providing evidence that establishes further support 
for the rejections of the claims. 

5. With regard to the rejection of claims 1-5 35 U.S.C. 101, Applicant argues that this is an 
improper rejection. However, as stated in MPEP 2106 II.A, when a claim is devoid of 
technological application, it should be rejected. 

With regard to claims 1, 6, and 11, Applicant argues that that prior art of record 
does not teach or suggest all of the claim limitations. The Examiner respectfully 
disagrees and maintains the rejections as shown below. Combining the privacy 
agreement of King with Kroenke's relational diagrams teaches the limitation in question. 
Taken together, as intended by the Examiner and not in a piecemeal fashion, the 
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combination of King/Kroenke teaches the limitations of independent claims 1, 6, and 11. 
Because King anticipates the inclusion of the privacy agreement, the rejection is proper 
and is maintained. 



Claim Rejections - 35 USC § 101 

6. 35 U.S.C. 101 reads as follows: 

Whoever invents or discovers any new and useful process, machine, manufacture, or 
composition of matter, or any new and useful improvement thereof, may obtain a patent 
therefor, subject to the conditions and requires of this title. 

7. Claims 1-5 are rejected under 35 U.S.C. 101 because the claimed invention is directed to 
nonstatutory subject matter. The basis of this rejection is set forth in a two-prong test of: 

(1) whether the invention is within the technological arts; and 

(2) whether the invention produces a useful, concrete, and tangible result. 

For a claimed invention to be statutory, the claimed invention must be within the 
technological arts. Mere ideas in the abstract (i.e., abstract idea, law of nature, natural 
phenomena) that do not apply, involve, use, or advance the technological arts fail to 
promote the "progress of science and the useful arts" (i.e., the physical sciences as 
opposed to social sciences, for example) and therefore are found to be non-statutory 
subject matter. For a process claim to pass muster, the recited process must somehow 
apply, involve, use, or advance the technological arts. 

In the present case, the recited steps of merely improving the handling of 
personally identifiable information by identifying the parties involved, identifying the data 
involved, classifying the data, and expressing each relationship, do not apply, involve, use, 
or advance the technological arts since all of the recited steps can be performed without 
the use of any technological apparatus, system or method such as, for example, a 
computer system, database, electronic circuit, or software application. These steps only 
constitute a method that is easily attainable without the use of any state-of-the-art devices 
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or techniques. As written, the steps and system components recited in the claim language 
could easily be implemented by using a pencil and paper by one of ordinary skill in the art. 

Claim Rejections - 35 USC § 103 

8. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all obviousness 
rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or 
described as set forth in section 102 of this title, if the differences between the subject 
matter sought to be patented and the prior art are such that the subject matter as a whole 
would have been obvious at the time the invention was made to a person having ordinary 
skill in the art to which said subject matter pertains. Patentability shall not be negatived 
by the manner in which the invention was made. 

9. Claims 1, 2, 6, 7, 11, and 12 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over King (EP 1,081,916 A2), in view of Kroenke, "Database Processing: Fundamentals, 
Design, and lmplementation"(c)1999, and further in view of Spies et al. (US 5,689,565). 

Examiner's Note: The Examiner has pointed out particular references contained in the 
prior art of record within the body of this action for the convenience of the Applicant. 
Although the specified citations are representative of the teachings in the art and are 
applied to the specific limitations within the individual claim, other passages and figures 
may apply. Applicant, in preparing the response, should consider fully the entire 
reference as potentially teaching all or part of the claimed invention, as well as the 
context of the passage as taught by the prior art or disclosed by the Examiner. 



Claims 1, 6, and 11: 
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King as shown, discloses the following limitations: 



identifying the parties involved in a process of handling personally 



identifiable information (page 4, lines 30-31); 



identifying the data involved in said process (page 4, lines 42-43); 



classifying the data (page 5, lines 50-51); 



expressing each relationship between each pair of said parties in terms 
of a privacy agreement (page 4, lines 30-31); 



said privacy agreement is specific to a single purpose (page 8, lines 1- 
50). 



said privacy agreement expresses rules regarding said privacy-related 
actions, for each of said parties (abstract); 



King does not specifically disclose the following limitations, but Kroenke, as 
shown does. 



representing said parties, said data, and said privacy agreements 
graphically in one or more privacy agreement relationship diagrams 
(Figures 3-3 to 3-11), wherein: 

said privacy agreement uses a limited number of privacy-related actions 
concerning said personally identifiable information (Figure 3-15); 



It would have been obvious to one of ordinary skill in the art at the time of the 
invention to combine King's method and system for exchanging sensitive information with 
Kroenke's relational database management system because the RDBMS allows entities 
and classes each with their own attributes to be modeled in relation to each other so as 
to form a construct that relies relationships and rules that would permit the use, access, 
and modification of sensitive personal information quickly and easily, as well as securely. 



Claims 2, 7, and 12: 
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King discloses exchanging sensitive information as shown above. King does not 
specifically disclose mapping a business process to the privacy rules that should govern 
the behavior of each pair of parties. However, Kroenke discloses entity relationship 
diagrams that show cardinality between classes and entities (see at leas Figures 3-3). 
Kroenke also discloses that there are many different ways of modeling a business 
situation using the relational data base environment (page 67). It would have been 
obvious to one of ordinary skill in the art at the time of the invention to combine King's 
method and system for exchanging sensitive information with Kroenke's relational 
database management system because the RDBMS allows entities and classes each 
with their own attributes to be modeled in relation to each other so as to form a construct 
that relies relationships and rules that would permit the use, access, and modification of 
sensitive personal information quickly and easily, as well as securely. 

10. Claims 3-5, 8-10, and 13-15 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over King (EP 1,081,916 A2), in view of Kroenke, "Database Processing: Fundamentals, 
Design, and lmplementation"(c)1999, and further in view of Spies et al. (US 5,689,565). 

Claims 3-5, 8-10, and 13-15: 

King discloses exchanging sensitive information as shown above. King does not 
specifically disclose mitigating the risks associated with handling sensitive information. 
Spies, however, in column 1, lines 26-29, states, "To provide a secure interchange of 
information in the electronic arena, one traditional approach to mitigating the risk of 
having sensitive information intercepted was to institute proprietary computerized 
systems that were closed to the general public." Although Spies does not specifically 
teach identifying opportunities to reduce privacy-related risks involved in said process, 
identifying unnecessary exchanges of data for possible elimination, and identifying 
opportunities to transform data into a less sensitive form, Spies shows that mitigating risk 
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associated with personal, sensitive information has been addressed by reducing and 
restricting the access that individuals and organizations have private data. Identifying 
opportunities to reduce the risk by reducing unnecessary changes to the data and 
transforming data into a less sensitive form are obvious ways of mitigating the risk of 
inadvertently releasing sensitive information into the hands of persons who are not 
authorized access to such a data. Spies, as shown above, foresees this risk and 
accomplishes the same resolution under the umbrella of reducing the exposure of 
sensitive information to authorized personnel. 

Conclusion 

11. Applicant's amendment necessitated the new ground(s) of rejection presented in this 
Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). 
Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a). 

12. A shortened statutory period for reply to this final action is set to expire THREE MONTHS 
from the mailing date of this action. In the event a first reply is filed within TWO 
MONTHS of the mailing date of this final action and the advisory action is not mailed until 
after the end of the THREE-MONTH shortened statutory period, then the shortened 
statutory period will expire on the date the advisory action is mailed, and any extension 
fee pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory 
action. In no event, however, will the statutory period for reply expire later than SIX 
MONTHS from the date of this final action. 
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Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to James A. Reagan whose telephone number is (703) 
306-9131. The examiner can normally be reached on Monday-Friday, 9:30am-5:00pm. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, James Trammed can be reached at (703) 305-9768. 

Any inquiry of a general nature or relating to the status of this application or 
proceeding should be directed to the Receptionist whose telephone number is (703) 
305-3900. Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for published 
applications may be obtained from either Private PAIR or Public PAIR. Status 
information for unpublished applications is available through Private PAIR only. For more 
information about the PAIR system, see http://portal.uspto.gov/external/Dortal/pair . 
Should you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). 

Any response to this action should be mailed to: 

Commissioner of Patents and Trademarks 
Washington, D.C. 20231 

or faxed to: 

(703) 305-7687 [Official communications; including 
After Final communications labeled "Box AF"] 

(703) 308-1396 [Informal/Draft communications, labeled "PROPOSED" 
or "DRAFT"] 

Hand delivered responses should be brought to Crystal >(^k 5,^$^ Costal 
Drive, Arlington, VA, 7 th floor receptionist. 
JAR 

03 September 2004 T^^^^y 




